IBM doubled down on confidential computing with Fortanix and said its Fortanix-powered IBM Cloud Data Shield now supports containerized applications on IBM Cloud Kubernetes and RedHat OpenShift. This allows businesses to move and secure applications in the public cloud by running them in a secure enclave on Intel Software Guard Extension (SGX) hardware.

Intel SGX is hardware-based technology that isolates specific application code and data to run in private regions of memory, thus protecting select code and data from disclosure or modification.

IBM Cloud Data Shield is based on Fortanix’s technology that runs on Intel SGX hardware and encrypts data at rest, in transit, and while in use, thus allowing general-purpose computation on encrypted data. The companies first partnered on the cloud-delivered security service in late 2017 and made Cloud Data Shield (formerly called Cloud Data Guard) generally available earlier this year.

About 10 customers including banks and financial institutions use the confidential computing service, said Nataraj Nagaratnam, CTO and director of cloud security for IBM’s Cloud and Cognitive Software business unit.

Also during this time, IBM added new capabilities to it, “around support for running this on OpenShift, given our overall hybrid cloud strategy,” Nagaratnam said. “Along those same lines: the no code change for Java” and Python. This means customers can use the service to secure their own custom application without any code modifications. In addition, IBM Cloud Data Shield offers pre-configured containers for databases, web servers, and OpenShift applications to make it easier for companies to securely develop new cloud-native applications.

For most enterprises, with the exception of financial technology firms and other emerging technology vendors, confidential computing remains “a curiosity to them,” Nagaratnam said. “If you look at the hype cycle, it’s probably in the emerging state of the curve for people to understand. It’s not mainstream yet.”

But that will likely change rapidly. As Fortanix CEO Ambuj Kumar said in an earlier interview, there’s a very real cost of not encrypting data. “If you are a Fortune 500 CEO, for example, there are maybe three things that will cause you to lose your job,” Kumar said. “Security and privacy breach is one of those three.”

Additionally, the early adopters that are using in-memory encryption to do things like process healthcare information and data analytics in the cloud, for example, “they really like it and recognize the importance of it as a differentiating capability,” Nagaratnam added.

To secure workloads as they move between on-premises data centers, public clouds, and the edge, data needs to be encrypted at rest, in transit, and in use. Of these three lifecycle stages, encrypting data in use is the most challenging. This is the problem that confidential computing seeks to address. It enables encrypted data to be processed in memory without exposing it to the rest of the system. This reduces exposure for sensitive data and provides greater control and transparency for users.

To this end companies including IBM, Red Hat (owned by IBM), Fortanix, Intel, Microsoft and others participate in the Linux Foundation’s Confidential Computing Consortium, which launched last August.

Confidential computing has several interesting new use cases, such as multi-party analytics, according to Nagaratnam, because it allows organizations to share private and analyze data while protecting privacy. “In a healthcare situation, genomics, or DNA processing where you are doing analytics on a DNA sample, the data is obviously so sensitive, protection of data in use, in memory, has a significant advantage,” Nagaratnam said.

Additionally, financial services companies use confidential computing to analyze data without exposing the underlying data to another party. By analyzing transactions, banks can also better detect money laundering or fraud.

In fact, banking fraud is also a confidential computing use case that Microsoft is working on with several of its customers, said Scott Woodgate, senior director of Azure Security, during an interview at RSA Conference in February. Microsoft Azure was the first public cloud to encrypt data while in use, and it teamed up with Intel to help design the SGX technology used in Intel’s Xeon chips, he added.

A little over two years ago Azure, in partnership with Intel, announced Azure confidential computing. It’s now available in public preview in three regions — the United States, United Kingdom, and Europe — and Woodgate expects it to be publicly available later this year.

However, IBM Cloud has confidential computing advantages over Azure, Nagaratnam said. “There are customers trying to do this on Azure and they started using IBM for a couple of reasons,” he explained. “Our technology was the first available globally. So if they have do some transaction and processing on other data centers anywhere in the world, we have this global availability.”

The second differentiator is IBM Cloud’s ability to do no-code change, which extends Intel SGX language support to Python- and Java-based applications. Developers aren’t necessarily security experts, he added, “and as these customers look at modern, cloud-native architectures and also want to do security in the cloud without being an expert, they liked what IBM had to offer. At IBM Cloud our focus is on security for the non-security developers.”